A few years ago, proposals for regulating artificial intelligence (AI) have been developed around the world, in countries such as the United States, China and the European Union, but they did not foresee the popularization of generative technologies, such as ChatGPT, which have raised new challenges for future legislation. Although some laws and bills already address some of these issues, at least to some extent, the proposals will need to be adapted to address new problems, according to experts.
"The main risk is perhaps the sheer number of risks," summarizes Tainá Aguiar Junquilho, a researcher at the Rio Institute of Technology and Society (ITS-Rio) and author of the book "Artificial Intelligence in Law: Ethical Limits." She believes the issue is complex. It's difficult to weigh all the issues involved in the use of generative AI systems. It's impossible to anticipate solutions to be addressed through regulation, which will require a broad multisectoral and multidisciplinary debate.
"Most regulatory models classify AI into risk levels, based on the use of the system being developed. Some authors believe that this type of regulation that classifies risk doesn't cover generative AIs, because they can be used in a variety of situations," he explains. "That's why it poses so many challenges."
Generative AIs can create a variety of data, such as images, text, video, and audio. They had been in development for a few years, but began to be used more widely after the release of chatbot from the OpenAI, on November 30, 2022. Although it's impossible to predict all of their impacts on society, some have already surfaced, according to the ITS-Rio researcher. Among the main ones are the opacity of these systems; the reinforcement of discrimination they can foster; the misinformation they can provoke; their potential data and copyright violations; and even impacts on the future of work.
Data protection
According to Junquilho, although most people believe that current regulations don't address generative AI, some believe that existing laws partially address these technologies. A good example is the General Data Protection Law (LGPD), which addresses one of the most sensitive issues related to generative AI, based on large language models (LLMs) trained from data obtained from the internet, often without consent. There is debate about the legitimacy of companies like OpenAI using this information to train their systems.
The first suspension of ChatGPT The world's largest data breach, which occurred in Italy in March 2023, was precisely due to this issue. The Garante Per La Protezione Dei Dati Personali (GPDP) issued a temporary order to halt the processing of Italian users' data on ChatGPT, expressing concern that the service may be violating the General Data Protection Regulation (GDPR) and opening an investigation. One of the suspicions was that there was no adequate legal basis for the collection of personal data.
"I don't have access to my training data, but I was trained on a mix of licensed data, data created by human trainers, and publicly available data. OpenAI has not publicly disclosed details about the training duration or the individual datasets used. I was trained on a mix of text from the internet, including books, articles, and websites," ChatGPT responded when asked about its training data.
OpenAI has taken a number of steps to comply with the GDPR, such as publishing information on its website clarifying which personal data is processed and the methods used to develop algorithms. It also granted the right to object to the processing of your personal data, including through an online form. But this may not be enough. "OpenAI has not yet made this significant effort to adapt to data protection laws," Junquilho assesses.
"From a legal perspective, nothing prevents these laws from being applied. In law, we have a principle that judges cannot exempt themselves from making decisions. They would have to find instruments within the current laws to decide. It would be possible, yes, to use these laws to regulate. However, a specific law can help solve these issues because it provides more systematicity. These issues remain unresolved and can generate legal uncertainty. A law can provide these answers in advance, giving greater predictability to the entire process," notes André Fernandes, director and co-founder of the Recife Institute for Research in Law and Technology (IP.rec).
This is the same view shared by Ana Bárbara Gomes Pereira, public policy coordinator and researcher at the Internet and Society Reference Institute (IRIS-BH). She believes that legislation is critically needed, as the field develops and changes rapidly. A law would address specific technology risks. "It's important that this is considered with the necessary complexity. It complements other regulatory efforts, which are being carried out in different spheres of the Internet, technology, and society in general," she explains.
Copyright
One of the novel questions raised by generative AI systems concerns the intellectual propertyThis can be best illustrated by image generators like Midjourney and Dall-E 2, which are based on both free-to-use and copyrighted content. These tools are capable of creating images with an artist's style, a fundamental part of this professional's identity.
"When you're an artist or the creator of some content, it violates not only your privacy but also your authorship, genius, and creativity, which ideally would require compensation," comments Junquilho of ITS-Rio. "Style defines a lot; it's a very specific part of an artist's work. As an artist, you could defend your copyright, the improper use of your art, and the model that profits from this unauthorized processing of these images," explains Fernandes of IP.rec.
This was one of the issues that members of the European Parliament tried to address in approved amendments to be added to the European AI Act on May 11, 2023. According to the proposed regulation, one of the most advanced in the world, developers of such AIs must provide summaries of the copyrighted content used to train the AI. They must also grant access to the database, when necessary, so that the European regulatory body can verify that the system is not infringing any intellectual property rules.
According to Victor Habib, a lawyer, professor, and researcher in the field of AI, the proposal should not undermine existing EU legislation on copyright and related rights. Lawmakers were concerned with harmonizing the regulation with the bloc's intellectual property laws.
"The proposed regulation establishes that providers of generative AI models must comply with transparency obligations. This means they must provide clear and accurate information about how their models are trained, including what data is used and how it is acquired. By ensuring transparency regarding the data used in AI training, it is possible to identify the authors of potential intellectual property and thus protect their respective rights," he explains.
Copyright laws already exist, but generative AI systems have changed the game, both in how they use this data for training and in how users use it to create new texts, images, and other content. There's no case law on the subject. According to intellectual property law, to hold a copyright on something, the author must have thought, planned, and executed the creation of a given work. In a work created by AI, the creator has influence by inputting the data, but not in the final result, which is generated by the algorithms. "Since it's an initial text, they've only defined general guidelines. It's not yet clear which specific solutions will be used in practice," he adds.
Transparency
Another point that the regulations seek to address concerns the opacity of generative AI systems—the lack of transparency or understanding of the processes and decisions made by these systems, which use complex algorithms, neural networks, and large data sets to learn patterns and create new content that resembles what was provided during training. However, these systems can be opaque in how they produce results. This lack of transparency can be problematic in several areas, including ethics, accountability, and trust.
Generative AI models are considered black boxes. It's difficult to understand the internal processes that lead to a given response. This is because they have millions (or even billions) of parameters, and their decisions are the result of complex calculations performed by these interconnected parameters.
"AI systems can present difficulties when it comes to understanding and holding their actions accountable. This is because they are constantly learning new functions and can become unpredictable, even to their creators, the programmers. This unpredictability of AI systems can generate risks and create legal loopholes, as it is not easy to determine precisely how and why a given result was produced by the AI system," Habib emphasizes.
Addressing the opacity of generative AI systems is an open challenge. Some regulatory proposals attempt to make them more transparent through AI explainability techniques, which attempt to provide insights into the model's decision-making process. Bill 2,338, presented on May 3, 2023, by Senate President Rodrigo Pacheco, foresees the need for companies to produce reports to provide more transparency to AI systems.
"Transparency obligations exist to better understand how this technology works, the right to explanation, but also for research purposes, so we have more clarity about what's happening. This way, we can make better inferences about what is and isn't desirable, what would or wouldn't be reliable. How are these systems responding? What level of accuracy are they offering society? And how are they preventing bias? These reports are crucial for society in general, but also for what comes next, so we can mature as researchers and take a critical look based on what we've seen so far and what has been documented and produced," says the IRIS-BH coordinator.
Regulation in the Senate
The most recent AI regulation proposal presented to the National Congress is based on the work of the commission of jurists which spent more than a year debating AI regulation. The bill proposes to replace previous projects, mainly the 21/2020, authored by Senator Styvenson Valentim (Podemos-RN), approved in 2021 by the Chamber of Deputies. It creates rules for AI systems available in Brazil, establishing the rights of those affected by their operation, defines criteria for the use of these systems by public authorities, and provides for penalties for violations of the law. It also establishes the establishment of a body to oversee and regulate the sector.
According to the ITS-Rio researcher, the bill assigns liability and sanctions to companies that violate the regulatory framework. Like most proposals, it also classifies AI into risk levels. The regulatory body may even introduce new risks if necessary. The bill also imposes a series of obligations on those who develop and operate AI systems in Brazil, establishing the possibility of regulated self-regulation, in which companies themselves define best practices for ethical AI.
To some extent, Junquilho believes the bill already addresses some issues related to generative AI. "It stipulates that it's high-risk AI when used for educational purposes. There are situations where you use generative AI for education. So, that would be a situation where you'd need to take more cautious measures. If, for example, OpenAI's system is used for education, they're developing high-risk AI, regardless of whether it's used solely for that purpose," he comments.
Pereira, from IRIS-BH, says that these rights apply to all types of AI, whether generative or not. The same applies to compensation for damages in the event of a violation of these rights. "The bill provides for the right to explanation, to challenge decisions that produce legal effects and that somehow impact the interests of users. These principles are crucial for understanding how a technology can interact, and what level of harm or effect it can cause in users' lives," he explains. "These basic rights are beneficial for simultaneously establishing an innovation ecosystem that ensures the production of socially positive technology. I think this applies to generative AI."
PL advanced
Whether or not it addresses issues related to generative AI, experts unanimously agree that the new bill presents a much more elaborate discussion than Bill 21/2020, a bill that more closely resembles a charter of principles, without outlining rights, duties, or how to ensure the law's effectiveness. "Legislation with multisectoral participation tends to be better than legislation that fails to listen to the public or the various sectors involved," emphasizes Junquilho, who contributed to the public hearings, which included experts from various fields.
For the director of IP.rec, this text is more relevant than the previous bill, as it addresses advances in the AI technical debate. It proposes a "common grammar." It's the same logic as the LGPD and GDPR. With the LGPD, data processing follows a minimum standard for research, development, and service provision processes, allowing Brazilian companies to offer their services on the European continent. The new bill establishes the same conditions for AI here in Brazil and in Europe, for example, but not only under the bloc's legislation but also in other countries.
"It allows Brazil not only to be aware of what works and what doesn't in AI, but also to be part of the international dialogue on the subject. This is very important, for these technologies, which are used in several countries, to have regulations that allow, for example, the Brazilian business model to be valid here in Brazil, but also to already have the minimum compliance measures in place to operate in Europe," explains Fernandes.
The debate on the proposal is expected to go to the Science and Technology Committee (CCT). There, the text must be presented for a preliminary approval opinion. Depending on the procedure established by the Senate presidency, it could go to the Citizenship and Justice Committee (CCJ), which evaluates its constitutionality and justice aspects. Finally, it would proceed to the plenary.
Having been introduced by the Senate president, Junquilho believes the bill already has greater momentum than if it had been proposed by any other senator. She also believes we are in a globally favorable moment for legislation, with discussions taking place worldwide. Even Sam Altman, CEO of OpenAI, has publicly called for AI regulation. "In my view, we will approve some regulation this year, or by 2024 at the latest, both to combat fake news and disinformation and for AI. We just don't know if the content will be more principled or if it will lean toward regulation with accountability and sanctions. This is a political issue and we don't know who will win," she assesses.
Full report below:
Português do Brasil 
English